DemoBook a demo

Vulnerability advisory

CVE-2026-59882

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

Published Updated OSV record ↗

Also known as GHSA-c2w2-prh8-qm98

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/guzzle/psr7 ↗
All commits before 7ec62dc3f44aa218487dbed81a9bf9bc647be55d7ec62dc3f44aa218487dbed81a9bf9bc647be55d
Not specifiedddd64f17d4cc1f7e5ffe6fd2c989ec7221712580
Also listed as affected (45)
  • 2.12.2
  • 2.12.1
  • 2.12.0
  • 2.11.1
  • 2.11.0
  • 2.10.1
  • 2.10.0
  • 2.9.0
  • 2.8.1
  • 2.8.0
  • 2.7.1
  • 2.7.0
  • 2.6.3
  • 2.6.2
  • 2.6.1
  • 2.6.0
  • 2.5.0
  • 2.4.4
  • 2.4.3
  • 2.4.2
  • 2.4.1
  • 2.4.0
  • 2.3.0
  • 2.2.2
  • 2.2.1
  • 2.2.0
  • 2.1.0
  • 2.0.0
  • 2.0.0-rc1
  • 2.0.0-beta1
  • 1.6.0
  • 1.5.0
  • 1.5.2
  • 1.5.1
  • 1.4.2
  • 1.4.1
  • 1.4.0
  • 1.3.1
  • 1.3.0
  • 1.2.3
  • 1.2.2
  • 1.2.1
  • 1.2.0
  • 1.1.0
  • 1.0.0

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.